@conference {300496,
	title = {Pivot: Fast, Synchronous Mashup Isolation Using Generator Chains},
	booktitle = {IEEE Symposium on Security and Privacy},
	year = {2014},
	address = {San Jose, CA},
	abstract = {
	Pivot is a new JavaScript isolation framework for\&nbsp;web applications. Pivot uses iframes as its low-level isolation\&nbsp;containers, but it uses code rewriting to implement synchronous\&nbsp;cross-domain interfaces atop the asynchronous cross-frame\&nbsp;postMessage() primitive. Pivot layers a distributed\&nbsp;scheduling abstraction across the frames, essentially treating\&nbsp;each frame as a thread which can invoke RPCs that are\&nbsp;serviced by external threads. By rewriting JavaScript call\&nbsp;sites, Pivot can detect RPC invocations; Pivot exchanges RPC\&nbsp;requests and responses via postMessage(), and it pauses\&nbsp;and restarts frames using a novel rewriting technique that\&nbsp;translates each frame{\textquoteright}s JavaScript code into a restartable\&nbsp;generator function. By leveraging both iframes and rewriting,\&nbsp;Pivot does not need to rewrite all code, providing an order-of-magnitude performance improvement over rewriting-only\&nbsp;solutions. Compared to iframe-only approaches, Pivot provides\&nbsp;synchronous RPC semantics, which developers typically prefer\&nbsp;over asynchronous RPCs. Pivot also allows developers to use\&nbsp;the full, unrestricted JavaScript language, including powerful\&nbsp;statements like eval().

},
	url = {http://scholar.harvard.edu/files/mickens/files/pivot.pdf},
	author = {James Mickens}
}
